CVE-2018-3978

CVE-2018-3978 is a vulnerability in Atlantis Word Processor’s Word Document parser (CLX/Clx handling in the Fib-based WordDocument table). A specially crafted Word binary (DOC) document can trigger a heap-based buffer overflow by mis-processing the Clx/Pcdt piece-descriptor table: the Clx.lcb con...

CVE-2018-3984

CVE-2018-3984 affects Atlantis Word Processor 3.0.2.3 and 3.0.2.5. The Word Document parser has an uninitialized length (SprmTDefTable) for the number of table columns, which is later used as a loop bound. A crafted Word doc can trigger a heap-based buffer overflow, leading to code execution unde...

CVE-2018-3978

An exploitable out-of-bounds write vulnerability exists in the Word Document parser of the Atlantis Word Processor 3.0.2.3, 3.0.2.5. A specially crafted document can cause Atlantis to write a value outside the bounds of a heap allocation, resulting in a buffer overflow. An attacker must convince ...

CVE-2018-3984

An exploitable uninitialized length vulnerability exists within the Word document-parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5. A specially crafted document can cause Atlantis to skip initializing a value representing the number of columns of a table. Later, the application will use...

Atlantis Word Processor Word Document Complex Piece Descriptor Table Fc.Compressed Code Execution Vulnerability

Summary An exploitable out-of-bounds write vulnerability exists in the Word Document parser of the Atlantis Word Processor. A specially crafted document can cause Atlantis to write a value outside the bounds of a heap allocation, resulting in a buffer overflow. An attacker must convince a victim ...

Highly Sophisticated Parasite RAT Emerges on the Dark Web

Researchers are tracking a remote access trojan RAT on underground markets that, so far, has only been attributed to one small malicious email campaign. However, the RAT, dubbed Parasite HTTP by the Proofpoint researchers that discovered it, has an impressive list of sophisticated features –...

Antenna House Office Server Document Converter for Linux64 Remote Code Execution Vulnerability

Antenna House Office Server Document Converter for Linux64 is a document format converter based on Linux64 platform from Antenna House, which is mainly used to convert Word, Excel and PowerPoint files to PDF, SVG and JPEG files, etc. It is mainly used to convert Word, Excel and PowerPoint files t...

Antenna House Office Server Document Converter for Linux64 Stack Buffer Overflow Vulnerability

Antenna House Office Server Document Converter for Linux64 is a document format converter based on Linux64 platform from Antenna House, which is mainly used to convert Word, Excel and PowerPoint files to PDF, SVG and JPEG files, etc. It is mainly used to convert Word, Excel and PowerPoint files t...

Antenna House Office Server Document Converter for Linux64 'putShapeProperty' Method Code Execution Vulnerability

Antenna House Office Server Document Converter for Linux64 is a document format converter based on Linux64 platform from Antenna House, which is mainly used to convert Word, Excel and PowerPoint files to PDF, SVG and JPEG files, etc. It is mainly used to convert Word, Excel and PowerPoint files t...

CVE-2018-3936

In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 6,1,2018,0312, a crafted Microsoft Word DOC document can lead to an out-of-bounds write, resulting in remote code execution...

CVE-2018-3933

An exploitable out-of-bounds write exists in the Microsoft Word document conversion functionality of the Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 6,1,2018,0312. A crafted Microsoft Word DOC document can lead to an out-of-bounds write, resulting in remote cod...

CVE-2018-3930

In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 6,1,2018,0312, a crafted Microsoft Word DOC document can lead to an out-of-bounds write, resulting in remote code execution. This vulnerability occurs in the vbgetfp method...

CVE-2018-3931

In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 6,1,2018,0312, a crafted Microsoft Word DOC document can lead to an out-of-bounds write, resulting in remote code execution. This vulnerability occurs in the putShapeProperty method...

Smoking Guns - Smoke Loader learned new tricks

This post is authored by Ben Baker and Holger Unterbrink Overview Cisco Talos has been tracking a new version of Smoke Loader — a malicious application that can be used to load other malware — for the past several months following an alert from Cisco Advanced Malware Protection’s AMP Exploit...

The vulnerability of the Microsoft Office software arises from an operation that goes beyond buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Microsoft Office package arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted DOCX file...

Malware analysis: decoding Emotet, part 1

Emotet Banking Trojan malware has been around for quite some time now. As such, infosec researchers have made several attempts to develop tools to de-obfuscate and even decrypt the AES-encrypted code belonging to this malware. The problem with these tools is that they target active versions of th...

Exploit for Out-of-bounds Write in Microsoft

CVE-2018-8174-msf This is a metasploit module which creates a...

Internet Explorer zero-day: browser is once again under attack

Update 2018-05-25: CVE-2018-8174 has been added to the RIG exploit kit MDNC. Update 2018-05-22: Security researcher Richard Warren mentioned that a fully working IE zero-day now patched with payload was uploaded to VirusTotal. We decided to test Malwarebytes against it, since last time we only ha...

Heap overflow

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service heap-based buffer overflow with write access or possibly have unspecifie...

Word Attachment Delivers FormBook Malware, No Macros Required

A new wave of document attacks targeting inboxes do not require enabling macros in order for adversaries to trigger an infection chain that ultimately delivers FormBook malware. Researchers at Menlo Security are reporting a wave of attacks that began last month that are targeting financial and...